Merge pull request #2998 in SNORT/snort3 from ~PRBHALER/snort3:sip to master

Squashed commit of the following:

commit 7a9104eaafb9a37030540bd69a354bd95b371520
Author: Pranav Bhalerao <prbhaler@cisco.com>
Date:   Mon Jul 26 11:13:19 2021 -0400

    flow: introduce bidirectional flag for expected session.

diff --git a/cmake/FindDAQ.cmake b/cmake/FindDAQ.cmake
index b92f0003043cfeb94aa3a31b97d38b68f266e084..6f74a496b280f72247202323af1ca9e0f20e1caf 100644 (file)
--- a/cmake/FindDAQ.cmake
+++ b/cmake/FindDAQ.cmake
@@ -16,7 +16,7 @@ This module defines:
 #]=======================================================================]
 
 find_package(PkgConfig)
-pkg_check_modules(PC_DAQ libdaq>=3.0.4)
+pkg_check_modules(PC_DAQ libdaq>=3.0.5)
 
 # Use DAQ_INCLUDE_DIR_HINT and DAQ_LIBRARIES_DIR_HINT from configure_cmake.sh as primary hints
 # and then package config information after that.

diff --git a/src/flow/expect_cache.cc b/src/flow/expect_cache.cc
index e6748772cdfc9afcbfe46cfe8993c98887bcabe9..1f185780d2d52ddb641abdbc666ce4bd36c66482 100644 (file)
--- a/src/flow/expect_cache.cc
+++ b/src/flow/expect_cache.cc
@@ -317,7 +317,8 @@ ExpectCache::~ExpectCache()
  */
 int ExpectCache::add_flow(const Packet *ctrlPkt, PktType type, IpProtocol ip_proto,
     const SfIp* cliIP, uint16_t cliPort, const SfIp* srvIP, uint16_t srvPort, char direction,
-    FlowData* fd, SnortProtocolId snort_protocol_id, bool swap_app_direction, bool expect_multi)
+    FlowData* fd, SnortProtocolId snort_protocol_id, bool swap_app_direction, bool expect_multi,
+    bool bidirectional)
 {
     /* Just pull the VLAN ID, MPLS ID, and Address Space ID from the
         control packet until we have a use case for not doing so. */
@@ -395,6 +396,10 @@ int ExpectCache::add_flow(const Packet *ctrlPkt, PktType type, IpProtocol ip_pro
             unsigned flag = 0;
             if (expect_multi)
                 flag |= DAQ_EFLOW_ALLOW_MULTIPLE;
+
+            if (bidirectional)
+                flag |= DAQ_EFLOW_BIDIRECTIONAL;
+
             ctrlPkt->daq_instance->add_expected(ctrlPkt, cliIP, cliPort, srvIP, srvPort,
                     ip_proto, 1000, flag);
         }

diff --git a/src/flow/expect_cache.h b/src/flow/expect_cache.h
index 5b5313bab478ef087c2a28966c60fad14be68179..1f88aac38c176dfc7afc38bd52842d21427b6e2c 100644 (file)
--- a/src/flow/expect_cache.h
+++ b/src/flow/expect_cache.h
@@ -98,7 +98,7 @@ public:
     int add_flow(const snort::Packet *ctrlPkt, PktType, IpProtocol, const snort::SfIp* cliIP,
         uint16_t cliPort, const snort::SfIp* srvIP, uint16_t srvPort, char direction,
         snort::FlowData*, SnortProtocolId snort_protocol_id = UNKNOWN_PROTOCOL_ID,
-        bool swap_app_direction = false, bool expect_multi = false);
+        bool swap_app_direction = false, bool expect_multi = false, bool bidirectional = false);
 
     bool is_expected(snort::Packet*);
     bool check(snort::Packet*, snort::Flow*);

diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc
index fc8bff39da77397aad4f66227c1f6b206336753d..20245dd2602f0b8e9b77a5cf1f99b2e172eb146b 100644 (file)
--- a/src/flow/flow_control.cc
+++ b/src/flow/flow_control.cc
@@ -573,10 +573,11 @@ int FlowControl::add_expected_ignore( const Packet* ctrlPkt, PktType type, IpPro
 
 int FlowControl::add_expected( const Packet* ctrlPkt, PktType type, IpProtocol ip_proto,
     const SfIp *srcIP, uint16_t srcPort, const SfIp *dstIP, uint16_t dstPort,
-    SnortProtocolId snort_protocol_id, FlowData* fd, bool swap_app_direction, bool expect_multi)
+    SnortProtocolId snort_protocol_id, FlowData* fd, bool swap_app_direction, bool expect_multi,
+    bool bidirectional)
 {
     return exp_cache->add_flow( ctrlPkt, type, ip_proto, srcIP, srcPort, dstIP, dstPort,
-        SSN_DIR_BOTH, fd, snort_protocol_id, swap_app_direction, expect_multi);
+        SSN_DIR_BOTH, fd, snort_protocol_id, swap_app_direction, expect_multi, bidirectional);
 }
 
 bool FlowControl::is_expected(Packet* p)

diff --git a/src/flow/flow_control.h b/src/flow/flow_control.h
index de1930301dce4dbe19b9af71964e8ff5f2fdc000..006931440d343a0b302a31ca654a51ea49569b7e 100644 (file)
--- a/src/flow/flow_control.h
+++ b/src/flow/flow_control.h
@@ -79,7 +79,8 @@ public:
 
     int add_expected(const snort::Packet* ctrlPkt, PktType, IpProtocol, const snort::SfIp *srcIP,
         uint16_t srcPort, const snort::SfIp *dstIP, uint16_t dstPort, SnortProtocolId snort_protocol_id,
-        snort::FlowData*, bool swap_app_direction = false, bool expect_multi = false);
+        snort::FlowData*, bool swap_app_direction = false, bool expect_multi = false,
+        bool bidirectional = false);
 
     class ExpectCache* get_exp_cache()
     { return exp_cache; }

diff --git a/src/flow/test/flow_cache_test.cc b/src/flow/test/flow_cache_test.cc
index 582818dd10c145c5f198a526123ea74306aeee8b..9a74618ca0b6d328a2290c154716071af1c051be 100644 (file)
--- a/src/flow/test/flow_cache_test.cc
+++ b/src/flow/test/flow_cache_test.cc
@@ -121,7 +121,7 @@ void Stream::stop_inspection(Flow*, Packet*, char, int32_t, int) { }
 
 
 int ExpectCache::add_flow(const Packet*, PktType, IpProtocol, const SfIp*, uint16_t,
-    const SfIp*, uint16_t, char, FlowData*, SnortProtocolId, bool, bool)
+    const SfIp*, uint16_t, char, FlowData*, SnortProtocolId, bool, bool, bool)
 {
     return 1;
 }

diff --git a/src/flow/test/flow_control_test.cc b/src/flow/test/flow_control_test.cc
index d03fb7aea28ac4f1f8888f067d14964817205984..f7bb208d79b1916c63cdfb6ec618eee766a60330 100644 (file)
--- a/src/flow/test/flow_control_test.cc
+++ b/src/flow/test/flow_control_test.cc
@@ -167,7 +167,7 @@ int ExpectCache::add_flow(const Packet*,
     PktType, IpProtocol,
     const SfIp*, uint16_t,
     const SfIp*, uint16_t,
-    char, FlowData*, SnortProtocolId, bool, bool)
+    char, FlowData*, SnortProtocolId, bool, bool, bool)
 {
     return 1;
 }

diff --git a/src/framework/base_api.h b/src/framework/base_api.h
index 45a3a8873d765b46440a663dad61e3744f258813..e416771bedce148d4fe3eaa22cd4efb816f49a14 100644 (file)
--- a/src/framework/base_api.h
+++ b/src/framework/base_api.h
@@ -29,7 +29,7 @@
 
 // this is the current version of the base api
 // must be prefixed to subtype version
-#define BASE_API_VERSION 5
+#define BASE_API_VERSION 6
 
 // set options to API_OPTIONS to ensure compatibility
 #ifndef API_OPTIONS

diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc
index d57c6422c2ec192e722af89aaf3a37ffe4ec3d24..ef39c79811121c306446bd6617ddc341bae4123b 100644 (file)
--- a/src/network_inspectors/appid/appid_session.cc
+++ b/src/network_inspectors/appid/appid_session.cc
@@ -209,7 +209,7 @@ static inline PktType get_pkt_type_from_ip_proto(IpProtocol proto)
 
 AppIdSession* AppIdSession::create_future_session(const Packet* ctrlPkt, const SfIp* cliIp,
     uint16_t cliPort, const SfIp* srvIp, uint16_t srvPort, IpProtocol proto,
-    SnortProtocolId snort_protocol_id, bool swap_app_direction)
+    SnortProtocolId snort_protocol_id, bool swap_app_direction, bool bidirectional)
 {
     char src_ip[INET6_ADDRSTRLEN];
     char dst_ip[INET6_ADDRSTRLEN];
@@ -228,7 +228,7 @@ AppIdSession* AppIdSession::create_future_session(const Packet* ctrlPkt, const S
     is_session_monitored(asd->flags, ctrlPkt, *inspector);
 
     if (Stream::set_snort_protocol_id_expected(ctrlPkt, type, proto, cliIp,
-        cliPort, srvIp, srvPort, snort_protocol_id, asd, swap_app_direction))
+        cliPort, srvIp, srvPort, snort_protocol_id, asd, swap_app_direction, false, bidirectional))
     {
         if (appidDebug->is_active())
         {

diff --git a/src/network_inspectors/appid/appid_session.h b/src/network_inspectors/appid/appid_session.h
index f8bcdd452127c54d861cb9761e0831cc0323a219..9ed1cf72c32a8c84fa7c17ff225a49ccd4570f77 100644 (file)
--- a/src/network_inspectors/appid/appid_session.h
+++ b/src/network_inspectors/appid/appid_session.h
@@ -236,7 +236,8 @@ public:
     static AppIdSession* allocate_session(const snort::Packet*, IpProtocol,
         AppidSessionDirection, AppIdInspector&, OdpContext&);
     static AppIdSession* create_future_session(const snort::Packet*, const snort::SfIp*, uint16_t,
-        const snort::SfIp*, uint16_t, IpProtocol, SnortProtocolId, bool swap_app_direction=false);
+        const snort::SfIp*, uint16_t, IpProtocol, SnortProtocolId, bool swap_app_direction=false,
+        bool bidirectional=false);
     void initialize_future_session(AppIdSession&, uint64_t);
 
     size_t size_of() override

diff --git a/src/network_inspectors/appid/detector_plugins/detector_sip.cc b/src/network_inspectors/appid/detector_plugins/detector_sip.cc
index 714597ae6342d18d908ca7fdd1f2fc2770e6b5c6..3342c6a7947d83fca87509973f406dab75053cb0 100644 (file)
--- a/src/network_inspectors/appid/detector_plugins/detector_sip.cc
+++ b/src/network_inspectors/appid/detector_plugins/detector_sip.cc
@@ -181,7 +181,7 @@ void SipServiceDetector::createRtpFlow(AppIdSession& asd, const Packet* pkt, con
 {
     AppIdSession* fp = AppIdSession::create_future_session(
         pkt, cliIp, cliPort, srvIp, srvPort, protocol,
-        asd.config.snort_proto_ids[PROTO_INDEX_SIP]);
+        asd.config.snort_proto_ids[PROTO_INDEX_SIP], false, true);
 
     if ( fp )
     {
@@ -200,7 +200,7 @@ void SipServiceDetector::createRtpFlow(AppIdSession& asd, const Packet* pkt, con
 
     AppIdSession* fp2 = AppIdSession::create_future_session(
         pkt, cliIp, cliPort + 1, srvIp, srvPort + 1, protocol,
-        asd.config.snort_proto_ids[PROTO_INDEX_SIP]);
+        asd.config.snort_proto_ids[PROTO_INDEX_SIP], false, true);
 
     if ( fp2 )
     {
@@ -235,8 +235,6 @@ void SipServiceDetector::addFutureRtpFlows(SipEvent& event, AppIdSession& asd)
     {
         createRtpFlow(asd, event.get_packet(), media_a->get_address(), media_a->get_port(),
             media_b->get_address(), media_b->get_port(), IpProtocol::UDP);
-        createRtpFlow(asd, event.get_packet(), media_b->get_address(), media_b->get_port(),
-            media_a->get_address(), media_b->get_port(), IpProtocol::UDP);
 
         media_a = session_a->next_media_data();
         media_b = session_b->next_media_data();

diff --git a/src/packet_io/sfdaq_instance.cc b/src/packet_io/sfdaq_instance.cc
index a3e0c694cbe34189eeb88dee49cb40d4932410a7..4f506e3d85ad95c0a7434fc20c950c9068032bbc 100644 (file)
--- a/src/packet_io/sfdaq_instance.cc
+++ b/src/packet_io/sfdaq_instance.cc
@@ -390,6 +390,8 @@ int SFDAQInstance::add_expected(const Packet* ctrlPkt, const SfIp* cliIP, uint16
     if (flags & DAQ_EFLOW_ALLOW_MULTIPLE)
         d_cef.flags |= DAQ_EFLOW_ALLOW_MULTIPLE;
 
+    if (flags & DAQ_EFLOW_BIDIRECTIONAL)
+        d_cef.flags |= DAQ_EFLOW_BIDIRECTIONAL;
 /*
     if (flags & DAQ_DC_FLOAT)
         d_cef.flags |= DAQ_EFLOW_FLOAT;

diff --git a/src/stream/stream.cc b/src/stream/stream.cc
index c0ca827ff0450de410830157f68836cfa3703ecc..028c6e2763e277907ea32ea60091f245db93c622 100644 (file)
--- a/src/stream/stream.cc
+++ b/src/stream/stream.cc
@@ -386,13 +386,14 @@ int Stream::set_snort_protocol_id_expected(
     const Packet* ctrlPkt, PktType type, IpProtocol ip_proto,
     const SfIp* srcIP, uint16_t srcPort,
     const SfIp* dstIP, uint16_t dstPort,
-    SnortProtocolId snort_protocol_id, FlowData* fd, bool swap_app_direction, bool expect_multi)
+    SnortProtocolId snort_protocol_id, FlowData* fd, bool swap_app_direction, bool expect_multi,
+    bool bidirectional)
 {
     assert(flow_con);
 
     return flow_con->add_expected(
         ctrlPkt, type, ip_proto, srcIP, srcPort, dstIP, dstPort, snort_protocol_id, fd,
-        swap_app_direction, expect_multi);
+        swap_app_direction, expect_multi, bidirectional);
 }
 
 void Stream::set_snort_protocol_id_from_ha(

diff --git a/src/stream/stream.h b/src/stream/stream.h
index 0ef87b9c948620b9e130095a8116fc2158c397dc..e99007a929822308946304daee938ab30320c4ca 100644 (file)
--- a/src/stream/stream.h
+++ b/src/stream/stream.h
@@ -173,7 +173,7 @@ public:
     static int set_snort_protocol_id_expected(
         const Packet* ctrlPkt, PktType, IpProtocol, const snort::SfIp* srcIP, uint16_t srcPort,
         const snort::SfIp* dstIP, uint16_t dstPort, SnortProtocolId, FlowData*,
-        bool swap_app_direction = false, bool expect_multi = false);
+        bool swap_app_direction = false, bool expect_multi = false, bool bidirectional = false);
 
     // Get pointer to application data for a flow based on the lookup tuples for cases where
     // Snort does not have an active packet that is relevant.